The catc USB driver in the Linux kernel assigns hard‑coded endpoint numbers for bulk and interrupt transfers without validating the descriptors supplied by a connected device. A malicious or malformed USB device can present endpoints with transfer types that differ from the driver’s expectations, leading the driver to use incorrect pipes. When the driver attempts to communicate using these mismatched descriptors it can trigger kernel instability or a panic, disrupting device operation and potentially bringing the entire system offline. The flaw is limited to the machine that has the device attached and does not provide remote code execution but results in a denial of service.

All Linux kernel releases that include the original, unpatched catc driver are affected. This includes legacy versions such as 2.6.12 and any distribution that ships an older kernel without the endpoint‑checking commit. Distributions that use newer kernels but have retained the unpatched code are also vulnerable until the kernel is updated with the commit that adds usb_check_bulk_endpoints() and usb_check_int_endpoints().

Based on the description, it is inferred that the attack vector is local physical USB insertion. Exploitation requires physical access to the target machine to insert a crafted USB device that supplies incorrect endpoint descriptors. No public evidence of remote exploitation exists and the vulnerability is not listed in CISA’s KEV catalog. The EPSS score of less than 1% indicates a very low overall exploitation probability. The CVSS score of 5.5 reflects moderate impact; the primary threat is denial of service due to kernel panic. The vulnerability maps to CWE‑1287 (Improper Control of Object References).